PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
Organization
Palo Alto Networks Unit 42
- Mentions · 7d0
- Mentions · 30d1
- All mentions5
- First seenAug 15, 2026
- Last mentioned7d ago
Timeline
5 articles · newest firstAgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems
AgtaBackup RAT uses fake Microsoft Store pages and legitimate RMM tools to steal data from Windows systems.
72
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Unit 42 details the Spring Ring voice phishing campaign abusing Microsoft Teams to deploy malware and target enterprise domain controllers.
70
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.
55
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.
76
Related CVEs
by mentions- CVE-2024-36401100%9.8Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Microsoftvendor · 2
- Palo Alto Networksvendor · 2
- Jewelbugthreat actor · 1
- Kimwolfmalware · 1
- European government entityvictim · 1
- Microsoft Teamsproduct · 1
- LogMeInvendor · 1
- ConnectWisevendor · 1
- Antinomalware · 1
- Lazarus Groupthreat actor · 1
- Microsoft Storeproduct · 1
- Earth Aluxthreat actor · 1
- ClientKingproduct · 1
- Palo Alto Networks Unit 42vendor · 1
- Trend Microorganization · 1
- Cloudflareorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.